CSSF Circular on outsourcing arrangements

On 22 April 2022, the Commission de Surveillance du Secteur Financier (“CSSF”) issued:

• Circular 22/805 on the revised EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02) – Publication of Circular CSSF 22/806 on outsourcing arrangements –Repeal or amendments of certain circulars CSSF (“Circular 22/805”);
• Circular 22/806 on outsourcing arrangements (“OS Circular”);
• Circular 22/807 updating CSSF Circular 12/552 on central administration, internal governance and risk management, as amended; and
• CSSF FAQ – Circular CSSF 22/806 on outsourcing arrangements providing guidelines on the scope and application of the OS Circular (“FAQ”).

As set out in Circular 22/805, the CSSF has integrated the revised EBA Guidelines on outsourcing arrangements in its administrative practice and regulatory approach via the OS Circular.

The OS Circular applies notably to credit institutions, investment firms, payment institutions, electronic money institutions, other professionals of the financial sector and their branches and partially to investment fund managers, their branches, central counterparties, approved publication arrangements, market operators operating a trading venue, central securities depositories, administrators of critical benchmarks and UCITS.

The OS Circular therefore covers more entities than the revised EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02), which the OS Circular implements. It represents the CSSF’s integrated framework on outsourcing arrangements and introduces a harmonised text governing outsourcing arrangements in order to promote convergence at a national level.

• Content and Structure
  The OS Circular gathers all supervisory requirements on outsourcing arrangements, including those on information and communication technology (ICT) outsourcing arrangements that were previously disseminated in individual circulars, in one single document.
  
  The OS circular is divided in two main parts: the first part sets out the requirements in relation to outsourcing arrangements and includes definitions, scope of application, general principles and applicable governance requirements; the second part is dedicated to specific requirements for ICT outsourcing arrangements relying or not on a cloud computing infrastructure.
   
• Main practical impacts, timeline and what to do next
  A critical change is the absence of the requirement to seek authorisation in the outsourcing of a critical or important function going forward. The OS Circular is applicable from 30 June 2022 to all outsourcing arrangements entered into, reviewed or amended on or after 30 June 2022. A transition period ending on 31 December 2022 applies to existing outsourcing agreements. For more details on the main practical impact, please read here.
   
• Amendments and repeal
  The following Circulars are amended as of 30 June 2022: CSSF Circulars 12/552, 20/758 and 04/155 as amended and IML Circulars 95/120, 96/126 and 98/143 as amended.
  
  The following circulars are repealed as of 30 June 2022: CSSF Circular 13/554, 15/611, 17/654, 17/656, 19/714, 17/654, 21/777, 17/654 and 21/785.